Provide a configuration to suppress detailed stack traces from the UI on 500 Internal Server Errors

XMLWordPrintable

    • Type: Suggestion
    • Resolution: Unresolved
    • None
    • Component/s: Environment - Other
    • None

      Actual Behavior:
      When Bitbucket Data Center encounters an unhandled exception (HTTP 500), the default error page often displays a full Java stack trace, including class names, internal file paths, and library versions.

      Expected Behavior:
      Administrators should have a configuration toggle (e.g., in bitbucket.properties) to suppress detailed error messages in the UI, showing only a generic "Internal Server Error" message to end-users while still logging the full trace to atlassian-bitbucket.log.

      Why this is important (Business Case):

      • Security Compliance: Many enterprise security policies and vulnerability scanners (like Qualys, Nessus, or Veracode) flag the display of stack traces as "Information Disclosure." This allows potential attackers to gain insight into the application's internal architecture.
      • STIG/Hardening Requirements: Organizations following STIG (Security Technical Implementation Guides) or other hardening frameworks are required to disable verbose error reporting in production environments.
      • User Experience: Detailed technical stack traces are confusing for non-technical users and provide no actionable value to them, whereas a clean, branded error page is more professional.

              Assignee:
              Unassigned
              Reporter:
              Bharat Malviya
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: